Our board is relieved. Every user data in our system is now not only consented, but also got corrected and verified in the process; and the consent sits with the people it belongs to, not on us.
The nonprofit's registration and survey forms used to ask 64 questions. They now ask 12. Names and phone numbers are hidden on every screen and in every Excel download, and each time a user unlocks a phone number, the platform logs it. The impact reports still work. The organisation did this with Commons Trust over eleven months, and the work is still going. We have not named it.
The method is simple to copy: drop what you do not need, and hide the rest by default.
Why forms grow, and why that matters
Our view: livelihoods programmes tend to collect a lot. A registration form grows a question each time a funder, a survey or a new scheme asks for something, and few questions are ever removed. That is how forms reach dozens of fields.
Under the DPDP Act, consent must be limited to the personal data necessary for the purpose you have stated (s. 6(1)). Every field has to be covered by a purpose in your notice (s. 5(1)), kept safe (s. 8(5)), and erased once that purpose is no longer served, unless another law requires you to keep it (s. 8(7)). Each extra field adds to all of that work.
The organisation dropped the fields it did not need from its registration and survey forms. Twelve remain.
Hiding what remains
For the data it still collects, the organisation changed who sees it:
- Names and phone numbers are hidden, on screen and in Excel downloads.
- A phone number can be unlocked when someone needs it, and every unlock is logged.
The Rules give masking as one example of the data security measures a Data Fiduciary must take at the minimum (Rule 6(1)(a)). They also require visibility on who accesses personal data, through logs, monitoring and review (Rule 6(1)(c)), with those logs kept for a year unless another law requires otherwise (Rule 6(1)(e)). Our view: hiding names and numbers by default, and logging each unlock, goes a long way towards both, though someone still has to review the logs. Rule 6 applies from 13 May 2027.
Our view: Excel downloads matter most here, because a spreadsheet that is emailed or copied to a laptop easily leaves an organisation's control.
Funders still get their evidence
The impact reports now use counts rather than names, and IDs rather than phone numbers. With names and numbers hidden, the reports kept running.
What the board says
The board is relieved. In its view, every piece of data in the system is now consented to and correct, and the job of giving or withdrawing consent sits with the people the data is about: users and beneficiaries themselves.
The Act requires withdrawal to be as easy as giving consent (s. 6(4)). It gives people the right to a summary of their data (s. 11), to have it corrected, completed, updated or erased (s. 12), and to have their grievances dealt with (s. 13). These rights apply from 13 May 2027. Our view: when people can act on those rights themselves, fewer requests have to be handled by hand, though the organisation must still respond to each one. If many of your members use basic phones, plan a way to withdraw that works on one.
Still going
Eleven months in, the work continues. Our view: that is to be expected. New programmes bring new forms, and every new form brings the same question back: what is each field for?
What you can take into your own organisation
- Count your fields. List every question on every form, then ask what each one is for.
- Drop what no purpose needs. A field you never collect never has to be protected, corrected or erased.
- Hide names and numbers by default, on screen and in downloads.
- Decide who may unlock a phone number, and why.
- Log every unlock, review the logs, and keep them for at least a year.
- Check your reports use counts and IDs, not names and phone numbers.
- Plan for the old data. Dropping a field stops new collection; erase what you already hold unless another law requires you to keep it.
- Review each new form before it goes live.
If you fund NGOs
Questions worth putting to your partners:
- How many fields are on your registration form, and what is each one for?
- Who on your team can see beneficiaries' names and phone numbers?
- Do your Excel exports carry names and numbers?
- Do you know who looked at a beneficiary's details last week?
- Can a beneficiary withdraw consent without calling your office?
If you want to know how many of your own fields you need, take our readiness check or write to us for a first call. Our guide to data mapping shows how to list what you hold.
This case study explains the law as of 26 October 2026; it is not legal advice.
Questions people ask
Does the DPDP Act require us to collect less data?
Yes, where you rely on consent. Consent must be limited to the personal data necessary for the purpose you have stated (s. 6(1)). The Act has no separate data-minimisation section, but every field you collect has to be covered by a stated purpose in your notice (s. 5(1)), protected (s. 8(5)) and erased once that purpose is no longer served, unless another law requires you to keep it (s. 8(7)). Fewer fields means less of all three. These duties apply from 13 May 2027.
Is masking names and phone numbers required?
The Rules give masking, along with encryption, obfuscation and virtual tokens, as examples of the security measures a Data Fiduciary must take at the minimum (Rule 6(1)(a)). They do not require masking in every case. Our view: hiding names and numbers from screens and downloads where staff do not need them is one of the cheapest ways to meet that rule. Rule 6 applies from 13 May 2027.
Why log every time someone sees a phone number?
The Rules require visibility on who accesses personal data, through logs, monitoring and review, so that unauthorised access can be detected and investigated (Rule 6(1)(c)), and those logs must be kept for a year unless another law requires otherwise (Rule 6(1)(e)). Logging each unlock gives a record of who saw which number and when; someone still has to review those logs. Rule 6 applies from 13 May 2027.
What happens to data we already collected in the fields we dropped?
If no stated purpose needs it any more, you must erase it, unless another law requires you to keep it (s. 8(7)(a)), and have any vendor holding it erase it too (s. 8(7)(b)). Check grant, accounting and audit rules first, and keep only what they need. Dropping a field from a form stops new collection; it does not remove what is already stored. This duty applies from 13 May 2027.